2022 CVEs (page 84)
Page 84 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44838 | High | 7.2 | 2022-12-09 | Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php. |
CVE-2022-4264 | Medium | 6.5 | 2022-12-09 | Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration. |
CVE-2022-44213 | Medium | 4.8 | 2022-12-09 | ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-2752 | Medium | 5.5 | 2022-12-09 | A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issu… |
CVE-2022-4377 | Low | 3.5 | 2022-12-09 | A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2022-4375 | Medium | 6.3 | 2022-12-09 | A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The… |
CVE-2022-33187 | Medium | 5.5 | 2022-12-09 | Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to re… |
CVE-2022-38765 | Medium | 6.5 | 2022-12-09 | Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imag… |
CVE-2022-41948 | Medium | 6.7 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege… |
CVE-2022-41947 | Medium | 5.4 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authen… |
CVE-2022-46158 | Medium | 5.3 | 2022-12-08 | PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been abl… |
CVE-2022-46153 | High | 8.1 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A… |
CVE-2022-41949 | Medium | 5.0 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2… |
CVE-2022-33186 | Critical | 9.8 | 2022-12-08 | A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute… |
CVE-2022-23496 | High | 7.5 | 2022-12-08 | Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possi… |
CVE-2022-23495 | High | 7.5 | 2022-12-08 | go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a… |
CVE-2022-23494 | Medium | 5.4 | 2022-12-08 | tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were… |
CVE-2022-23469 | Low | 3.5 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Auth… |
CVE-2022-44938 | Critical | 9.8 | 2022-12-08 | Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. |
CVE-2022-41717 | Medium | 5.3 | 2022-12-08 | An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by t… |
CVE-2022-4366 | High | 7.5 | 2022-12-08 | Missing Authorization in GitHub repository lirantal/daloradius prior to master branch. |
CVE-2022-46831 | Medium | 6.6 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to… |
CVE-2022-46830 | Medium | 4.1 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. |
CVE-2022-46829 | High | 7.1 | 2022-12-08 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
CVE-2022-46828 | Medium | 5.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. |
CVE-2022-46827 | Low | 3.9 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
CVE-2022-46826 | Medium | 6.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-46824 | Medium | 5.6 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. |
CVE-2022-40939 | Medium | 4.9 | 2022-12-08 | In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2… |
CVE-2022-38599 | Medium | 6.5 | 2022-12-08 | Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface. |
CVE-2022-4123 | Low | 3.3 | 2022-12-08 | A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to co… |
CVE-2022-4122 | Medium | 5.3 | 2022-12-08 | A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure. |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45525 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the downaction parameter at /goform/CertListInfo. |
CVE-2022-45524 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave. |
CVE-2022-45523 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/L7Im. |
CVE-2022-45522 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter. |
CVE-2022-45521 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter. |
CVE-2022-45520 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/qossetting. |
CVE-2022-45519 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter. |
CVE-2022-45518 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SetIpBind. |
CVE-2022-45517 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/VirtualSer. |
CVE-2022-45516 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/NatStaticSetting. |
CVE-2022-45515 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the entries parameter at /goform/addressNat. |
CVE-2022-45514 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/webExcptypemanFilter. |
CVE-2022-45513 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter. |
CVE-2022-45512 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeEmailFilter. |
CVE-2022-45511 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex. |
CVE-2022-45510 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the mit_ssid_index parameter at /goform/AdvSetWrlsafeset. |
CVE-2022-45509 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName. |
CVE-2022-45508 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter at /goform/editUserName. |
CVE-2022-45507 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the editNameMit parameter at /goform/editFileName. |
CVE-2022-45506 | Critical | 9.8 | 2022-12-08 | Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName. |
CVE-2022-45505 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at /goform/exeCommand. |
CVE-2022-45504 | High | 7.5 | 2022-12-08 | An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot… |
CVE-2022-45503 | High | 7.5 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing. |
CVE-2022-45501 | High | 7.5 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/wifiSSIDset. |
CVE-2022-45499 | High | 7.5 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/WifiMacFilterGet. |
CVE-2022-45498 | High | 7.5 | 2022-12-08 | An issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot the… |
CVE-2022-45497 | Critical | 9.8 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand. |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-44932 | High | 7.5 | 2022-12-08 | An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service. |
CVE-2022-44931 | High | 7.5 | 2022-12-08 | Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet. |
CVE-2022-44455 | Medium | 6.8 | 2022-12-08 | The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficie… |
CVE-2022-41802 | Medium | 4.0 | 2022-12-08 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes pa… |
CVE-2022-3262 | High | 8.1 | 2022-12-08 | A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an a… |
CVE-2022-3260 | Medium | 4.8 | 2022-12-08 | The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly… |
CVE-2022-39915 | Low | 3.3 | 2022-12-08 | Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), a… |
CVE-2022-39914 | Medium | 4.0 | 2022-12-08 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acc… |
CVE-2022-39913 | Medium | 6.8 | 2022-12-08 | Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. |
CVE-2022-39912 | Medium | 6.2 | 2022-12-08 | Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to… |
CVE-2022-39911 | Medium | 4.8 | 2022-12-08 | Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsung Pass. |
CVE-2022-39910 | Low | 3.9 | 2022-12-08 | Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of a… |
CVE-2022-39909 | High | 7.1 | 2022-12-08 | Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create a… |
CVE-2022-39908 | Medium | 6.9 | 2022-12-08 | TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write. |
CVE-2022-39907 | Medium | 6.9 | 2022-12-08 | Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds… |
CVE-2022-39906 | Low | 2.3 | 2022-12-08 | Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information. |
CVE-2022-39905 | Medium | 4.0 | 2022-12-08 | Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit int… |
CVE-2022-39904 | Low | 3.3 | 2022-12-08 | Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identif… |
CVE-2022-39903 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. |
CVE-2022-39902 | Medium | 6.5 | 2022-12-08 | Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call. |
CVE-2022-39901 | Medium | 6.5 | 2022-12-08 | Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNod… |
CVE-2022-39900 | Medium | 4.6 | 2022-12-08 | Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the… |
CVE-2022-39899 | Medium | 5.7 | 2022-12-08 | Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gestu… |
CVE-2022-39898 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. |
CVE-2022-39897 | Medium | 4.4 | 2022-12-08 | Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. |
CVE-2022-39896 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. |
CVE-2022-39895 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit inte… |
CVE-2022-39894 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via imp… |
CVE-2022-38754 | High | 8.0 | 2022-12-08 | A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticat… |
CVE-2022-37918 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37917 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37916 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-4364 | High | 7.3 | 2022-12-08 | A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the componen… |
CVE-2022-4354 | Medium | 4.3 | 2022-12-08 | A vulnerability was found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /blog/comme… |
CVE-2022-4353 | Low | 3.5 | 2022-12-08 | A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this vulnerability is the function IpUtil.getIpAddr. The ma… |
CVE-2022-4350 | Low | 3.5 | 2022-12-08 | A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation… |
CVE-2022-4349 | Medium | 4.3 | 2022-12-08 | A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cro… |
CVE-2022-4348 | Low | 3.5 | 2022-12-08 | A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSO… |